Scope of DCAA's access to internal audits still muddled

The Defense Contract Audit Agency is tasked with oversight of the Defense Department's myriad defense contracts.

But its mission also often requires it to oversee defense contractors — and their internal business systems.

It's no secret DCAA has faced obstacles on that front. Defense companies have their own internal audit departments, and they're not always eager to turn their information over to DCAA. There is also disagreement about the scope of the agency's authority to request those internal documents.

GAO's director of acquisition and sourcing management issues, Bill Woods, told In Depth with Francis Rose the problem doesn't necessarily lie with the companies' internal audits themselves, but with DCAA's access to them.

As part of the watchdog agency's review, it examined internal audits of seven of the largest defense companies.

"When we compared those audit departments and the standards that they used, they compared very favorably to the standards maintained by the Institute of Internal Auditors," an independent organization, which sets audit standards, Woods said.

Over the course of 2008 and 2009, those seven companies prepared about 1,100 audits, of which 520 were relevant to their business systems. However, DCAA requested access to only 115 audits over the same period.

Woods said the lack of audit access was due to a number of culprits. First, DCAA doesn't keep track of the number of audits the agency actual requests of companies or the number of audits that companies independently initiate. And the audits the agency does receive are often vaguely titled.

"Very often those titles are too brief to really inform DCAA about what they might find in those audit reports," Woods explained.

There are also contradictory assessments of DCAA's legal access to internal audits.

DCAA needs to assign points of contact for major companies to help keep track of audit requests.

The agency should periodically review audit-request information to determine if they've been successful.

DCAA should provide more training to its workforce about what types of materials the agency can request.

In a response to the report, DoD Deputy Chief Financial Officer Mark Easton said the Pentagon agrees with the latter two recommendations, but only "partially concurs" with the first.

"The department is skeptical that fully implementing the GAO recommendations will ensure (DCAA) has full access to and use of contractor internal audits," Easton wrote in DoD's response. "as GAO found during the audit, companies currently place limits on access to internal audit information based on interpretations of DCAA's access authority and related court cases.